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© Microcontroller provided with hardware for supporting debugging as based on boundary scan 
standard-type extensions. 

© A microprocessor comprises a processor element a memory interface element an IO interface element, a 
debug support element and an internal bus interconnecting all above elements. For easy debugging, it also 
comprises attached to the internal bus a registered boundary scan standard (JTAG) interface that accesses one 
or more scan chains inside the microprocessor, and is arranged for controlling DMA-type exchanges via the 
internal bus with other elements connected to this bus. 
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/5 SUMMARY TO THE INVENTION 



In consequence, amongst other things it is an object ot the present invention to diminish the above 

siiyrTV* improve functiona,ity ,hrou9h the *»• * •» -oJ-wTS^ts 

standard fac.rt.es that currently are being introduced into a large fraction of complex integrated drS 
ELT! ; 9 f ° 006 ° f " S aSP6CtS - the invention is characterized in that by ^SSSSi^Su 

chZ „vh 3 T t6red b0U " dary SCa " St3ndard (JTAG > interface eteme "t «i accesses on or more scan 
chams ns.de sa,d microprocessor, and furthermore is arranged for controlling DMA-type exchanges ^ta said 

5T*?S i?2SL2? lw X T r EE standard ,149 - 1 - ■ nd in partico,ar in GB patent *p£En 

Stennif corres P° ndl "9 US Application Serial No. 07/90489 to the present assignee. Originally the 
Standard was conceived to facilitate board level testing, but it offers many advantages ™ tSwS'^l 

*££X£ sTl^f 3nd in C r eqU6nCe hereinaft9r be «-« ^sten^fo^evfty 
BhTS 1^ n w ? m,n ' mUm t6St ,nterfaC8 haS 0ne data in P ut °™ serial data output 
pin a test clock p.n. and a test control pin. An additional reset pin is optional. Accordino to the Standard 

Tfo^ZsZlT™?- 3 COntr0, ^ 15 '° aded ^ 3 « ly be uSt 

the test n^Z^ ! h ^ qUeSt '° n ' and S ° Pr ° VideS t6St initializa «o«- According to the Standard, next 
elf olTJL f a " mpUt re9iSter - AftSr 3 ^ interVal 0f normal «P«"« * circuit, the £ 
SSL aSd S r T " h 0 T WhiCh may be 0Veriaid wi,h « he "ext test pattern 

coZr,ion IT 6 f haVe 5660 Pr0p ° sed - A particular feature of * ne S ^a^ is the one bit bypass 
^l^bl T " d ! 8rial ° UtPUt F ° r 6XeCU,ing 0,6 debu ^"9' «» or more data reglste s 
Z TSZr ° n " Ch,P bUS and the Serial JTAG ,est intertace - *is way. only the four or 

Pr ° Per t0 the JTAG interface must added to *• circuit functional By itsert 

the Direct Memory Access or DMA feature is a standard functionality in a microprocessor environment 

seri^ectlos M e o r nti0a ^ JT f int6rfaCe ^ " 0W aCCeSS various chains ^ con 1st of 
Serfacf 5 ^ETT " ""^ ° f arran 9 ed «* '"ese scan chains the JTAG 

TZ to the SEE £ ,re * F mem0ry aCCeSS DMA ,0 311 Actional units that are connectab.e as 

«Sk£ BOOT L I 6X T P,e ' JTAG aCC6SS ,0r effec «"9 LOAD. CHANGE, 

hll » operations. Likewise, it may access ROM memory. Likewise, it may access 

ESS? re9 ' SterS T 8ffeCtin9 SET and ,NSPECT operations - Likewisa - « ^cess an exZa3 
counter ITS. - " may aCC6SS vario °* other ° leme ^ "STS 

S^£EJ22 n X co T re9isters - and other e,emen,s - accordin9 to the needs ° f a desi 9"- 

eTenTente bl T .T?r I 6lemen,B Ca " a,S ° be reaChed by the software ' 80 that accessing these 
elements by the JTAG .nterface .s an excellent mechanism for allowing debugging, tracing and other test 

2ET« T ^ 3 COnSe ^ e " ce of the ab0 -. the processor e.ement 9 nl not h'alt ,s J£ 
tens I c^mun,cat,on between the debug support element and the various scan chains. Advantageously 
sa.d JTAG .nterface element allows downloading informations communicated by an external station This 
downloads process is based on the peek and poke primitives, known from their widespread usage in 
vanous computer languages, for so accessing the memory and filling it quickly with new information 

Advantageously the debug support element is externally to the internal bus directly connected to the 
processor element. This close interconnection allows for easy scrutinizing, without in doing so necessitating 
bus cycle tome: in th.s way. a trace buffer located in the debug support element can be filled directly from 
the processor element. 
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Advantageously, the JTAG interface directly accesses one or more breakpoint registers. This allows to 
load these registers at run time for subsequent evaluation while maintaining standard run speed. 

Advantageously, the debug support element contains an internal event trace buffer memory for 
accommodating a restricted set of contents of non-sequential addresses as generated by the processing 
5 element and allowing at least one of the following storage modes for a limited time operation of said 
microprocessor: storing of all non-sequential addresses, and/or storing of all call, jump, and trap addresses, 
or any appropriate selection or part of these. This represents a broad spectrum of debug operations that 
need only little hardware, inasmuch as only an appropriate fraction of the addresses, and in particular the 
relatively most critical ones of these are retained. 
w Further advantageous aspects of the invention are recited in dependent Claims. The invention in 
particular has been considered as an advantageous functionality extension for SPARC microprocessors, 
although its application is not limited to this particular type. 

BRIEF DESCRIPTION OF THE DRAWINGS 

75 

These and other aspects and advantages will be discussed more in detail with reference to the 
disclosure of preferred embodiments hereinafter, and in particular in and by the appended Figures that 
show: 

Figure f a microcontroller with hardware for event tracing; 
20 Figure 2 a tracing example; 

Figure 3 a JTAG boundary scan block in the architecture; 
Figure 4 an embodiment of serial event output facilities; 
Figure 5 an embodiment of a basic serial out protocol. 

25 DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 

Figure 1 shows a debugging environment with a microcontroller or microprocessor provided with the 
basic hardware for event tracing. Microcontroller 20 sits on target board 24 together with its system RAM 
memory 26. The microcontroller 20 is provided with a boundary scan or JTAG debug interface 46 that via 

ao JTAG board connector 28 and interconnection 34 is connected to host workstation 32 that itself has a JTAG 
interface card 30. The latter can interface to a plurality of JTAG interconnections such as 36. Microcontroller 
20 has an on-chip system bus 48 that interconnects various subsystems, such as JTAG debug interface 46, 
a debug support unit 56 with an on-chip trace memory 58, processing element with caches 60, memory 
interface 62, and various further unnamed subsystems 50-54. such as an 10 interface element. Via 

35 interconnection 64, debug support unit 56 is connected to a test probe or logic analyzer that has a serial-to- 
parallel converter 42, an event trace memory 40, and receives a time stamp from a source not shown. The 
event trace memory 40 via interconnection 36 that may be JTAG based is connected to host work station 
32. System RAM 26 contains a debug section 44 that is addressed by a symbolically indicated debug trap 
vector. Finally, there is a direct interconnection 57 between the debug support unit 56 and JTAG interface 

40 46. 

Serial output 64 has a one-bit-wide data path plus CLKOUT and provides real-time information on the 
occurrence of software or hardware triggered events, such as: it shows the general flow of software, 
identifies task latency in a multitasking system, identifies software sections that are of special interest for 
debugging, and triggers an external logic analyzer hardware under software control. According to the 

45 invention, the event trace facility does not need to provide trace reconstruction with instruction address 
granularity but it gives a good overview on the time behaviour of embedded real-time software. It is useful 
for timing analysis and performance measurement. 

The serial event information is a 0..16 bit data packet plus start and stop condition signals. Together 
with a time stamp, the parallelized data packet is stored in the event trace memory 40, that has a cycling 

50 address counter. The CLKOUT signal not separately shown provides synchronization, and may be a 
subharrnonic of the microcontroller clock. Events may without limitation be triggered by three causes: 
execution of a special non-privileged instruction, entry of traps and/or interrupts, and by a matchpoint 
occurring at match by a debug condition compare register. In the realization with the SPARC microcontrol- 
ler the yet unused and unprivileged instruction WR ASR31 is used as event trigger ; its opcode field 

55 accommodates a 13 bit immediate operand. Its value is defined either manually during software develop- 
ment, or automatically at compilation time via a prologue/epilogue mechanism for every individual subrou- 
tine. Execution of the WR ASR31 instruction occupies the IU pipeline for only one clock cycle. In many 
cases this is so little that the debug instructions need not be removed from the final code. Another hardware 
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platform would need a similar feature. 

The above explains the double usage of the JTAG interface for debugging. Two optional pins may be 
added for enhanced functionality. The double usage of the interface needs only littfe extra on-chip hardware 
area for implementing basic features, but may be expanded in a straightforward way. Basic features are the 
5 following: 

- JTAG provides straightforward host-target communication 

- Provision of software breakpoints 

- Hardware single-step 

- External break request and reset control from the host. 
w A few useful extensions are: 

- Hardware breakpoints on instruction address, data address, data store value and range 

- On-chip memory for instruction address trace at various different levels of trace granularity 

- Serial real-time event trace output facility including event identification. 

The JTAG debug interface block at the target processor side provides the following internal data 
is registers for debug communication purposes that can be read and written bit-sequentially by the host 
system: DMA_ADDR, DMAJDATA. DMA_CONTROL_STATUS. By means of these registers, the inter- 
face block provides a bridge functionality between the external JTAG bus and an on-chip system bus. Any 
memory-mapped slave-type device connected to the latter bus system can be accessed via the bridge from 
the host system. Thus the host is able to perform direct memory accesses (DMA) to any memory mapped 
20 resource of the target system. The DMA_ADDR register must be initialized with the target address before a 
DMA access. The DMA_DATA register must be initialized with write data before a write access can be 
initialized. After a DMA_READ access, the DMA_DATA register contains the read data. The 
DMA__CONTROL_STATUS register provides the following control functions: 

- select DMA access type (read/write, ASI-control space, byte-halfword-word selection) 
25 - start the DMA access 

- lock the system for exclusive JTAG usage of the DMA feature 

- auto-incrementing of the DMA_ADDR register contents 

- force a system RESET 

- issue an external debug break or trap request 

30 - handshake flags for host-target monitor communication protocol. 

In this manner a cooperation between the communication protocol and the direct memory access facility 
has been realized. The registers have been well-defined and geographically clustered. The DMA is 
synchronized by a different clock TCK than the system clock and its register accessing can be executed 
even if the system clock is unavailable, such as in standby state. Also the test clock TCK may be much 

35 slower than the system clock; cf. Figure 3, nos. 96, 98. These organizational aspects facilitate designing the 
control software, because all relevant information is now present inside the DMA scan chain. 

The following status information is visible to the host system when reading the 
DMA__CONTROL STATUS register: 

- DMA busy and handshake flags for bidirectional hosMarget monitor communication protocol 
40 - break status and status flags indicating states such as processor error or power down. 

If the JTAG interface is indeed provided with an independent TRSTN reset line, it is possible to reset 
the DMA registers while the target system is kept running. An even more interesting operating mode is 
keeping the processor in reset and initialize the JTAG facilities through loading appropriate registers. Now, 
the following exemplary subsystems can be accessed through JTAG DMA access: 
45 - interface to an external memory that becomes JTAG-accessible 

- IO interface that renders IO devices JTAG-accessible 

- internal memory such as RAM, ROM, Cache and MMU Translation lookaside buffer TLB 

- internal registers such as timers, counters, interrupt and application cell functions 

- debug support registers, such as for break-point match and application cell functions. 

so All these subsystems are memory-mapped and can be accessed directly from the target system 
without processor intervention. The DMA controlled by the JTAG interface is an extremely straightforward 
vehicle. The processor element can even continue executing any ongoing program execution. Furthermore, 
because JTAG needs only brief accesses, the system bus remains largely available for other stations 
intending to be bus master. Finally, uploading and downloading between internal target system and external 

55 target system is fast: for example <5 sees for 1 MByte data at a 10 MHz test clock. Internal processor 
registers, such as the register file(s) or the Ancillary State Registers ASR that have been defined in the 
SPARC microcontroller cannot be directly accessed through JTAG, but only by monitor software. For this 
purpose, the host system can request a debug break via the JTAG DMA_CONTROL_STATUS REGIS- 
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TER, thus forcing the processor to enter the monitor program. The data exchange between the monitor 
program that runs on the target system, and the host computer is performed via memory locations that are 
accessible via the JTAG DMA, and associated input and output buffers. The communication protocol has a 
handshake. 

s As shown in the debug configuration system of Figure 1, the system RAM has a small section allocated 
for debug support. This section contains 

- a debug trap handler program that provides a link to the monitor program 

- either a full monitor program, or only those monitor command routines that may execute one 
command at a time 

io - buffers for communicating command + parameters and response between host and target monitor 

- direct accessibility from the host via JTAG DMA. 

These features have cost advantages in that no extra pins are needed, no dual port is necessary that 
should be accessible from both host and target processor, and no time-critical multiwire link is necessary 
from target processor to a remote debug RAM. During the debugging process no special firmware is 

75 required like a boot-PROM on the target board. Debug trap handlers and monitor program are downloaded 
via JTAG into system RAM before the target processor starts program execution. 

An extra problem for real-time instruction tracing in RISC type processors is that in each clock cycle 
one or more instructions are fetched from an internal cache memory whose addresses are not visible at the 
chip boundary. To solve the problem a limited size on-chip trace memory of 32 entries has been provided 

20 that loads internal addresses and can be read by the host via the JTAG facilities. The small size of the trace 
memory necessitates scrupulous assigning of its capacity. Various trace modes are: load all addresses, 
load all non-linear addresses, that is those that are other than the simple increment-by-one, and load only 
addresses following call, trap or jump instructions. A further usage is to start loading upon reaching a preset 
breakpoint, and subsequently loading all addresses until the trace memory is full. Various combinations of 

25 the above are also useful. 

The serial event output facility 64 is used for time stamping of the entries in the external trace memory 
40. The event output provides information in real-time on the occurrence of software- or hardware-triggered 
events. Its main applications are to: 

- show the general flow of software 

30 - identifies interrupt latencies in a system 

- identifies task activity in a multitasking system 

- identifies software sections that may need special debugging 

- triggers an external analyzer under software control. 

A relatively small trace buffer, although not providing trace reconstruction with instruction address 
35 granularity, generally will give an excellent overview on the time behaviour of embedded real time software, 
which is useful for performance measurement and timing analysis. The required facilities are a serial 
parallel converter 42, a trace memory 40 of appropriate capacity, and a timestamp generator mechanism as 
indicated. 

As shown In the example of Figure 2, trigger instructions are preferably placed at strategic positions, 

40 such as trap exits, subroutine entries and exits, and jump table targets. In Figure 2 time runs horizontally. 
The solid steps show machine activity that alternates between main program level 78, subroutine levels 72, 
74, 76, and trap routine level 70. Trace 80 symbolizes the serial event output data through blocks. Here, 
these occur at start, at entrance and exit of all subroutines, at watchpoint hit (diamond at level 76) and 
finally at breakpoint hit (level 78). A WR ASR31 instruction is shown by a small circle and a trap is 

45 symbolized by a block. The span of coverage of the internal trace buffer is indicated at level 82. When 
using a watchpoint hit, the match occurred causes a debug trap to the processor, which then must execute 
a trap handler. Subsequently, it will wait for commands from the host. This is communicated to the host via 
a status register contained in the JTAG interface. 

Figure 3 illustrates the JTAG boundary scan block inclusive of its various operating modes in the 

so processor architecture. For brevity, the JTAG facilities are only recited without further detail. The five pins at 
bottom are test clock TCK, test reset TRST, test mode select TMS that controls the various modal 
transitions in TAP controller 90, test data in TDI, and test data out TOO. The port acts as a DMA master on 
the internal bus shown as a heavy line at the top; the port may access any slave connected to the bus, 
even while the processing element is executing. During arbitration, the port has highest priority. The DMA 

55 operation is initiated via the boundary scan external interface, such as by all external work station. The 
boundary scan facilities number a device ID register 106. Clocked instruction register 104 loads from TDI 
and accommodates five-bit instructions. The following instructions are used: 
Instruction • Mnemonic Register length Function 
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00000 

00001 

00010 

01000 

10000 

10001 

10010 

10011 

11111 



EXTEST 
IDCODE 

SAMPLE/PRELOAD 
MACRO 

DMA_ADDR 

OMA_DATA 

DMA_CNTL_STAT 
DMA_ALL 
BYPASS 



32 
32 
32 
1 

32 
32 
14 
78 
1 



Select boundary scan register 
Chip identification cod© 
Select boundary scan register 

2^ 

DMA address register 
DMA data register 
DMA control/status register 
all DMA registers in one chain 
bypass mode 
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[11 J: DMA_CNTL_STAT: DMA_START BUSY. This bit controls the start of the DMA and signals if 

the DMA has been finished. The DMA START__BUSY has to be written 0 to allow the read value to go 

to 0 ( = DMA finished). Setting DMA__START BUSY will clear this bit. Read: 1 = DMA busy. 0 = DMA 

finished or not started. Write: 1 - start DMA, 0 = no change. The basic loop for starting DMA is: 
5 write DMA_.CNTL__.BUSY - 1 

wait til! DMA_CNTL_BUSY = 1 {DMA access is started) 

write DMA_CNTL_BUSY = 0 

wait till DMA__CNTL_BUSY a o (DMA access is finished) 

The read DMA CNTL BUSY value will not change from 1 to 0 before a write 0 to DMA CNTL BUSY 

io has been effected when the read DMA__CNTL BUSY = 1. This is to ensure that the software has 

detected a 'V (DMA started) before subsequently the 'DMA finished* is signalled. 

[12]: DMA CNTL_START: JTAG BREAK. Write only: 1 = generate break trap, 0 = no break trap. 

With this bit a break trap can be generated in the IU. 

[13]: DMA_CNTL_STAT: JTAG_RESET. Write only 1 = reset, 0 = no reset. With this bit the circuit 
75 can be reset via the JTAG interface. 

Some example values for the DMA CNTL STAT register contents: 

00 1001 0001 0100: Start DMA write, size is word, no control space, no bus lock, increment 

DMA__ADDR before DMA is started and set TIF flag in DSU__STAT 
control register if DMA is ready. 
20 00 1010 0110 0010: Start DMA read in control space, size - byte, lock the bus for further 

DMA transfers, clear TOF flag when DMA is 
finished. 1 0 0000 0000 0000: RESET the circuit. 

01 0000 0000 0000: generate a break trap in the integer unit. DMA CNTL__STAT(3] can be 

used to check if the break trap has indeed been taken. 

25 The PI core bus has been shown by the heavy line at the top of the Figure. Further subsystems of the 
arrangement are JTAG controller module 90, called TAP controller with test clock, test reset, and test mode 

inputs, DMA control module 92, registers DMA ADDR 94 and DMA DATA 96, clock register SS__CLOCK 

98, register OMA__CNTL STAT 100,, Information holding register and decode 102, JTAG information 

register 104, device ID register 106, and output multiplexer 108. One of the inputs to the latter is JTAG 

30 chain input 108. Various subsystems as shown can be loaded form the serial data in chain TDK For brevity, 
the hardware particular to the JTAG standard interface has only been sketched in a summary way. 

Figure 4 shows an example of hardware facilities for serial event output. In the setup, the central PI Bus 
is attached to various subsystems, and surrounded by a few non-connected subsystems, these are as 
follows: 

35 - the processor clock 120 

- the central reset facility 122 

- the bus control unit 124 

- interrupt controller 126 

- instruction requester (cache), symbolized 128 
40 - memory management facility 130 

- data requester (cache), symbolized 132 

- debug support unit 134 

- serial event output facility 136 

- various unnamed further subsystems 138 
45 - memory Interface element 1 40 

- JTAG boundary scan facilities 142 including TAP controller 

- integer processing unit 1 44 

- optional floating point unit 146. 

Most of the above subsystems may be of standard functionality. For simplicity, the direct interconnec- 
so tion between the debug support unit and the JTAG interface (item 57 in Figure 1) has not been shown here. 
It is used to directly and quickly communicate breakpoint hit information into the DMA_CNTL_STAT 
register. Via polling via the PI bus this would have taken much longer but now it can be effected by means 
of the BRK__STAT functionality discussed with respect to Figure 3. 

Figure 5 shows an example of a basic serial out protocol that may occur on line 64 in Figure 1 . The 
55 protocol leans somewhat on the well known I2C protocol described in EP Patent Application 51332. During 
standard data transfer, transitions on the single data line (lower trace) may occur when the clock (upper 
trace) is low. If the clock is high, no such transition is allowed. Start condition 152 and stop condition 154 
violate these prescriptions through data transition when the data is high, and so realize their intended 
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operations. Outside of the data transfer interval, the clock trace may continue. In the present example the 
serial event outputting has been caused by the execution of the brief instruction WR ASR31. Just as in I2C, 
the event identifications are coded in a range from 0 to 2 13 by the number of 13 bits. For enhancing transfer 
speed, leading zeroes are suppressed. In this way, also a flexible packet length is realized. When no serial 
5 event information is output, the EVENT_OUT line is constantly held at T level. During transmission, the 
first bit indicates the packet type, and is followed by data. 

The information received at the probe 38 in Figure 1 is parallelized and stored together with a time 
stamp taken at the start condition in the external event trace memory. The CLKOUT signal from the target 
processor is required for synchronization purposes. Bits on the serial signal output are synchronous to 
w CLKOUT normally running at system clock speed. In case of very high system clock frequency it may be 
required to perform the serial output at a subharmonic of the system clock. Facilities on the target board 
allow easy connection to a probe or logic state analyzer. 

Recapitulating, the JTAG facilities are enhanced by adding DMA registers for communicating between 
JTAG and the on-chip system bus. In particular DMA may function as bus master. Seen from the debug 
is support unit DSU, an instruction trace memory has been added on-chip, and is provided with a serial event 
output. Finally, an external event trace buffer has been added that is driven by a serial event output. 

Claims 

20 1, A microprocessor comprising a processor element, a memory interface element, an 10 interface 
element, a debug support element and an internal bus interconnecting all above elements, character- 
ized by comprising attached to said internal bus a registered boundary scan standard (JTAG) interface 
element that accesses one or more scan chains inside said microprocessor, and furthermore is 
arranged for controlling DMA-type exchanges via said internal bus with other elements connected to 

25 said internal bus. 

2. A microprocessor as claimed in Claim 1, wherein said JTAG interface element allows bidirectional 
downloading informations with respect to an external station. 

30 3, A microprocessor as claimed in Claims 1 or 2, wherein said debug support element is externally to said 
internal bus directly connected to said processor element. 

4. A microprocessor as claimed in Claims 1, 2 or 3, wherein the JTAG interface element directly accesses 
one or more breakpoint registers. 

35 

5. A microprocessor as claimed in any of Claims 1 to 4, wherein the JTAG interface element directly 
accesses a trace buffer external to the microprocessor. 

6. A microprocessor as claimed in any of Claims 1 to 5, wherein said debug support element contains an 
40 internal buffer memory for accommodating a restricted set of contents of non-sequential addresses as 

generated by the processing element and allowing at least one of the following storage modes for a 
limited time operation of said microprocessor: storing of all non-sequential addresses, and/or storing of 
all call, jump, and trap addresses, or any appropriate selection or part of these. 

45 7. A microprocessor as claimed in Claim 6, wherein said debug support element interfaces externally to 
the microprocessor via a serial clocked data path to an external event trace buffer memory for thereto 
outputting event signalization for storage. 

8. A microprocessor as claimed in Claim 7, wherein a special instruction (WR ASR31) is arranged for 
so controlling loading of said external event trace buffer memory. 

9. A microprocessor as claimed in Claims 7 or 8, wherein the external trace buffer memory is arranged for 
together with recording any word therein also recording an actual time stamp indication. 

55 10- A microprocessor as claimed in Claims 7, 8 or 9, wherein the external trace buffer memory is arranged 
for via a standard further interface outputting data to a standard workstation or personal computer. 
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